1. OSG RA, DOEGrids CA features Doug Olson, LBNL August 2006

2. 2 Contents RA, agent, sponsor layout & OU=People use case Sample web form Agent Role GridAdmin Role Questions Schedule

3. 3 1.Subscriber requests Certificate 2.RM posts signing request notice 3.The RA for the Subscriber retrieves request 4.The RA agent reviews request with Grid project 5.The agent updates/approves/rejects request 6.Approved Certificate Request is sent to CM Grid Classic PKI People Certificate Workflow Subscriber 1 2 Registration Authority (RA) Agent 3 4 7 8 9 7.CM issues certificate 8.RM sends Email notice to Subscriber 9.Subscriber picks up new certificate 2 Sponsor Project DBMS 4 5 6 Certificate Manager (CM) (Certificate Signing Engine) Registration Manager (RM) PKI1.DOEGrids.Org CA

4. 4 2. notify OSG RA Layout CDF CMS DES DOSAR DZero Fermilab fMRI GADU geant4 GLOW GRASE GridChem GridEx GROW i2u2 iVDGL LIGO mariachi MIS nanoHUB SDSS STAR USATLAS DOEGrids CA 1 Registration Manager Registered VOs Registered Support Centers CSC DOSAR DZero Fermilab fGOC GADU GRASE GROW-GOC LIGO mariach-support OSG-GOC PROD_SLAC SDSS STAR TACC UC CI USATLAS USCMS VDT Agents within each support center know which VOs and sites they support Subscriber Sponsor Certificate 10. download 4.c verify4.d reply 4.e. confirm or deny 5. approve or reject request 1. submit Subscriber chooses one of the existing OSG registered VOs Draft 19 Apr 2006 Typical use case for personal certificate. 3. retrieve request 4.b authenticate 7. 6. 2,8. notify VO sponsor DB 4.a check authorized sponsors RA Log 9. Record RA actions LDAP Cert. directory Publish certificates

5. 5 Things on the horizon ESnet has a new version of the CA software in and house under investigation –RedHat Certificate System http://www.redhat.com/solutions/rhcs/ evolution of same code base of iPlanet/SUN CMS OSG RA setting up Roundup Issue Tracking to track request processing with more flexibility than the CA Agent interface. –Will form basis of RA performance metrics. Implementing https based sponsor confirmation as alternative to digitally signed email DOEGrids/ESnet looking at setting up CA tied to other user account database via Radius, such as LDAP, …

6. 6 Interfaces we can affect Cert Request form (somewhat) Cert management scripts Email request notices to agents (somewhat) Consider separate OSG Registration Manager to isolate OSG from other RA requests Ldap directory of published certificates